A Linux kernel vulnerability was fixed that prevented scheduling deferred kernel page table freeing during system boot. The issue caused kernel panics when using a boot-time function tracer with a filter, due to workqueue usage before initialization. The fix delays scheduling the freeing work until the system is fully booted.
CVE-2026-99092 is a vulnerability in the Linux kernel affecting the riscv architecture's handling of bpf-jit execmem addresses. The issue arises from incorrect assumptions about memory writability in the vmalloc area when CONFIG_STRICT_MODULE_RWX is disabled, causing BPF JIT compilation to fail. This bug affects kernel version 6.10 and similar configurations where strict module RWX enforcement is not enabled. The flaw has been fixed in specific commits addressing the patch_map() function to correctly handle executable memory mappings for BPF JIT code.
A vulnerability in the Linux kernel Bluetooth management (MGMT) subsystem caused pending commands flushed on power off to report an incorrect status. Specifically, commands pending when the Bluetooth adapter powers off were incorrectly answered with a success status (0x00) instead of the appropriate error status (e.g., Not Powered or Invalid Index). This could cause user-space components like bluetoothd to crash due to unexpected responses. The issue has been fixed in Linux kernel versions 6.6.160, 6.2, 6.11, 6.12, and related releases.
CVE-2026-99090 is a vulnerability in the Linux kernel's AMDGPU driver where vblank counter reads are not properly serialized against GPU resets. This can cause unsafe hardware access during GPU recovery, triggering kernel warnings and tainting the kernel. The issue is fixed by acquiring a semaphore before hardware access or returning a cached software count if reset is in progress.
A vulnerability in the Linux kernel's ASoC Samsung i2s driver causes an imbalance in runtime power management due to the op_clk clock not being enabled during device probe. This leads to a warning during boot related to clock disablement. The issue is fixed by enabling op_clk in the probe function and disabling it in the remove function.
A vulnerability in the Linux kernel's Open vSwitch component related to IPv6 address rewrite actions on IPv6 fragments has been fixed. The issue occurs because the transport header is not properly validated before being accessed, leading to uninitialized memory reads that trigger warnings under debug configurations. The fix involves early return in the checksum update function to avoid reading uninitialized transport header offsets for IPv6 fragments.
CVE-2026-90885 is an XML External Entity (XXE) vulnerability in the Apache Camel Saxon component affecting versions from 4.0.0 before 4.18.5 and from 4.19.0 before 4.22.2. The vulnerability arises because the default Saxon Configuration used by XQueryBuilder accepts DOCTYPE declarations and resolves external entities when the message body is already a javax.xml.transform.Source, allowing external entity expansion. This can lead to unauthorized file reads and network requests initiated by the vulnerable process. The issue is fixed in Apache Camel versions 4.18.5 and 4.22.2.
CVE-2026-77062 is a vulnerability in the boneIO Black web interface where the lack of clickjacking protections allows remote attackers to embed the control panel in an iframe and trick authenticated users on the internal network into performing unauthorized actions. These actions include activating relays, opening gates, or controlling blinds, which may have physical safety implications. The issue is exacerbated by CVE-2026-77053, which disables authentication by default, allowing any internal network user to trigger these actions via a malicious website. This vulnerability was fixed in boneIO version 1.6.0.
CVE-2026-94386 is a vulnerability in Apache Camel's OAuth component affecting versions from 4.19.0 up to but not including 4.22.2. The issue arises from a static token cache keyed only by token endpoint and client ID, causing tokens to be shared across profiles with different scopes or client secrets. This can lead to outbound requests carrying tokens with broader or unintended scopes, potentially granting excessive access to services. The vulnerability is fixed in version 4.22.2 and later.
CVE-2026-77061 is a vulnerability in boneIO versions 1.2.0 up to but not including 1.6.0 where several API endpoints are excluded from authentication. This allows an unauthenticated attacker on the local network to access sensitive information such as system logs, firmware version, serial number, MQTT username, configuration file listings, and API documentation. The issue was fixed in version 1.6.0 by requiring authentication for all API routes, disabling interactive API documentation, and withholding the serial number from anonymous users.
boneIO black_debian_images versions from 1.2.0 up to but not including 1.6.0 improperly set world-readable permissions on the Mosquitto MQTT broker password file located at /etc/mosquitto/passwd. This allows any local user to read password hashes for all MQTT accounts, enabling offline dictionary attacks. The issue is fixed in version 1.6.0.
CVE-2026-77059 is a time-of-check to time-of-use (TOCTOU) race condition vulnerability in boneIO versions 1.3.0 up to but not including 1.6.0. The flaw exists in the create_timedatectl_sudoers_file() function, which writes sudoers rules to a predictable temporary file, validates them, and then installs them with root privileges. An attacker with local access can exploit the race window between validation and installation or leverage the predictable filename to perform symlink attacks, resulting in arbitrary sudoers rule injection and local privilege escalation to root. This vulnerability was fixed in boneIO version 1.6.0.
boneIO Black versions from 1.2.0 up to but not including 1.6.0 are vulnerable to Cross-Site Request Forgery (CSRF) attacks on all state-changing API endpoints. The product lacks CSRF tokens and does not validate Origin or Referer headers, allowing remote attackers to craft malicious webpages that can perform unauthorized actions such as rebooting the controller, toggling relay circuits, controlling gates and blinds, or shutting down the device. This vulnerability leads to loss of integrity and availability. The issue is compounded by CVE-2026-77053, which disables authentication by default, enabling any user on the same internal network to trigger these actions. The vulnerability was fixed in version 1.6.0.
boneIO Black versions prior to 1.6.0 do not limit authentication attempts on their web interface or SSH service and lack password complexity enforcement. This allows unauthenticated remote attackers to perform unlimited brute-force login attempts, potentially compromising user accounts and gaining unauthorized access. Version 1.6.0 addresses these issues by implementing rate limiting on web login attempts, enforcing a minimum password length of 8 characters, and restricting SSH authentication attempts to three per connection with a shortened login grace time.
The boneIO black_debian_images product included a Mosquitto MQTT broker configured with default credentials that are identical across all devices and publicly documented. This allows remote attackers to gain full read and write access to the broker, enabling control over connected devices such as relays, blinds, and gates, and the injection of fake entities into linked Home Assistant installations. The vulnerability was fixed in version 1.6.0 by generating unique MQTT passwords per device at first boot. Devices upgraded from earlier versions retain their old credentials, but the web panel notifies owners if default credentials are still in use, prompting a change.
CVE-2026-77055 is a critical vulnerability in boneIO black_debian_images where the boneio service account is granted excessive privileges, including passwordless sudo access and membership in the docker group. This allows a local attacker who compromises the boneio user to escalate privileges to root. The issue is fixed in version 1.6.0 by removing these privileges and enforcing command restrictions with cryptographic verification.
boneIO versions 1.2.0 up to but not including 1.6.0 store sensitive passwords, including MQTT broker and web panel passwords, in cleartext. The API endpoint GET /api/config exposes these passwords to any authenticated user. Due to a related vulnerability (CVE-2026-77053) disabling authentication by default, unauthenticated attackers on the local network can also access these passwords. Version 1.6.0 fixes this by hashing web panel passwords and restricting access to the MQTT broker password, which remains recoverable but is no longer exposed via the API.
boneIO Black firmware versions prior to 1.6.0 have authentication disabled by default on their management web API, exposing all endpoints without requiring credentials. This allows unauthenticated remote attackers to fully control the device, including causing denial of service, modifying configurations, and operating connected physical circuits. The issue was fixed in version 1.6.0 by requiring an administrator account creation during the first-run wizard and restricting API routes to authenticated roles. Versions before 1.2.0 are based on Debian 10, unsupported, and cannot be upgraded in place; affected devices must be re-flashed with the 1.6.0 system image.
boneIO Black versions from 1.3.0 up to but not including 1.6.0 expose a Node-RED instance without authentication via a Caddy reverse proxy at the /nodered/ path. This allows unauthenticated local network attackers to deploy malicious flows through the Node-RED Admin API, enabling remote code execution and full control over the home automation system. The vulnerability is fixed in version 1.6.0.
CVE-2026-116340 is an authorization bypass vulnerability in iFlytek astron-agent versions 1.1.0, 1.1.1, and 1.1.2. It affects the FileInfoV2Service.listKnowledgeByPage function in the Console Knowledge-List Endpoint by manipulating the argument space-id. The vulnerability can be exploited remotely without user interaction and requires low privileges. Public exploit code is available. The vendor has not responded to disclosure and no patch or fix information is provided.